SRX

Hi,

I'm trying to configure a site-to-site VPN with full mesh, my side is a SRX240 cluster, the remote location uses Cisco ASA (not sure about the exact model, I don't have management access).

We need to connect multiple networks on both sides and the examples [0] are unfortunately not working in our enviroment because they are based on FBF rules - the st0 interface doesn't support firewall filters.

Network schema:

10.0.0.0/24   10.1.0.0/24
       ||       ||
       LAN      LAN
       ||       ||
      -------------
      | Cisco ASA |
      -------------
            ||
            VPN
            ||
     -------------
     |  SRX 240  |
     -------------
     reth0     st0
      ||        ||
      LAN       VPN
      ||        ||
10.2.0.0/24   10.3.0.0/24

Any ideas how to roll out such a VPN structure? I'm quite sure it should be possible (routing instance voodoo?) but I'm not able to think anymore outside the box - any input is appreciated!

Thanks, Renke

[0] http://kb.juniper.net/InfoCenter/index?page=content&id=KB28861

Hello ,

if you need full mesh , creat a route based VPN and confilgure traffic selectors  ( Starting from 12.1X46 )  . This will help you to have full mesh VPN .

http://kb.juniper.net/InfoCenter/index?page=content&id=KB28820

Sam,

thanks a lot - I will take a look at the release (the version used in our prod environment is 12.1.x44, though)

Renke

Hello ,

Thanks , Keep us posted once you implement so that we can help if you run into any issue .

Sam,

sorry for the delay - only last week the Cisco guy was willing to reconfigure the VPN to my test setup with a 12.1X46 - it works great!

Renke

It has always been a real pain to configure VPN to ASA and traffic selectors made it a bit easier.

Another option, if your Junos version does not support traffic selectors is to try to summurize the subnets as much as possible and then configure it as multple vpn statement with multiple subinterfaces, but keeping the gateway and policies, etc. the same, something like:

	vpn vpn1.1 {
 	    bind-interface st0.1;
 	    ike {
 		gateway gw1;
 		proxy-identity {
 		    local 10.10.10.0/24;
 		    remote 192.168.1.0/24;
 		    }
 		    ipsec-policy policy1;
 		}
 	}

	vpn vpn1.2 {
 	    bind-interface st0.1;
 	    ike {
 		gateway gw1;
 		proxy-identity {
 		    local 10.10.11.0/24;
 		    remote 192.168.1.0/24;
 		    }
 		    ipsec-policy policy1;
 		}
 	}
 	vpn vpn1.2 {
 	    bind-interface st0.2;
 	    ike {
 		gateway gw1;
 		proxy-identity {
 		    local 10.10.12.0/24;
 		    remote 192.168.2.0/24;
 		    }
 		    ipsec-policy policy1;
 		}
 	}

Hello ,

Multiple IPSEC VPN instance  was the work around before traffic selectors to implement multiple subnet case behind the VPN firewalls . 

Traffic selectors made it easier to setup .